nishat-06 commented on PR #8687: URL: https://github.com/apache/hadoop/pull/8687#issuecomment-5326152106
Fair point, and I'll concede the framing. I don't have a real-setup PoC, and you're right that a remote byte-by-byte recovery is drowned out by the latency and jitter across the full request path, so the practical-exploit language in the description overstates it. I'd rather keep this as plain hardening than an active-exploit claim: it makes the MAC check constant-time and consistent with how the rest of the tree already compares secrets (MessageDigest.isEqual in the delegation-token and Signer paths), with no behavior change. Happy to reword the description to drop the exploitability claim if that reads better to you. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
